Electrical Killswitch

The invention relates to a system for cutting power to one or more devices.

In certain situations, it is important to cut power to a powered device with high reliability. For example, US2014/126594 discloses a killswitch system for a laser. As soon as the system detects a failure, it cuts power to the laser for safety reasons. In trading, this importance became apparent in 2012 when Knight Capital tried, but failed, to stop its trading systems.

Cutting power to computer and network systems guarantees that they stop immediately, which guarantees the termination of misbehaving or unexpected behavior. While Power Distribution Units (PDUs) exist that can be switched on and off remotely, e.g. the APC Rack PDU 9000 switched (e.g. APDU9941), these PDUs are not designed to fail in an appropriate way; upon loss of connection they become uncontrollable themselves.

It is an objective of the invention to provide a system, which can cut power to a powered device, e.g. mounted in a rack, after loss of control over the powered device.

In a first aspect of the invention, a system for cutting power to one or more powered devices comprises an actuator which controls the power to said one or more powered devices. Said actuator is, or one or more controllers connected to said actuator are, configured to receive a kill command over a network and said actuator is configured to cut power to said one or more powered devices when said actuator, or at least one of said one or more controllers, receives said kill command. Said actuator is, or said one or more controllers are, configured to receive a heartbeat signal over said network and said actuator is configured to cut power to said one or more powered devices when said actuator is, or all of said one or more controllers are, no longer receiving said heartbeat signal.

Thus, the actuator will cut power if the actuator or controller is commanded to, and will also cut power if the actuator is not receiving the heartbeat signal or none of the one or more controllers is receiving the heartbeat signal.

This killswitch system is an out-of-band system which may be used to power down most infrastructure in a colocation. No power means that the electrical devices connected to the switch will not be able to operate, which is the required effect. A killswitch system is preferably placed in the area of least change, which in co-locations are the racks and power distribution units. They are often installed only once at build time and are then stable for the lifetime of the rack, which can be decades. Racked equipment like servers and network connections changes at a much higher pace.

When a heartbeat signal is no longer received over the network by the actuator or by a controller, this might imply that the actuator or the controller cannot receive kill commands either. In this situation, the actuator or the controller will fail-safe and shut off the power to the powered device(s) via the actuator.

Said system may comprise said one or more controllers and said actuator may be configured to cut power to said one or more powered devices when it loses connection to all of said one or more controllers. This is an additional fail-safe.

Said system may comprise said one or more controllers, said one or more controllers may comprise multiple controllers, and said multiple controllers may be connected to said actuator, wherein said multiple controllers are configured to receive said kill command over said network and said actuator is configured to cut power to said one or more powered devices when at least one of said multiple controllers receives said kill command, and wherein said multiple controllers are configured to receive a heartbeat signal over said network and said actuator is configured to cut power to said one or more powered devices when all of said multiple controllers are no longer receiving said heartbeat signal.

If one or more controllers are used, it is especially beneficial to let multiple controllers control the one or more actuators. This may be used to provide redundancy in case of a single communication error. In this case, the actuator(s) will only cut power when all controllers fail to receive heartbeats. One controller receiving a kill command will cause all actuators to cut power, irrespective if the other controllers have received similar kill commands.

It is also cost efficient to let a controller control multiple actuators. For example, said system may further comprise a further actuator which controls the power to one or more further powered devices, said further actuator may be connected to said one or more controllers, said further actuator may be configured to cut power to said one or more further powered devices when at least one of said one or more controllers receives said kill command, and said further actuator may be configured to cut power to said one or more further powered devices when all of said one or more controllers are no longer receiving said heartbeat signal. Said actuator, said further actuator, and said one or more controllers may be connected to each other via a bus or a local network, for example.

Said system may comprises said one or more controllers and each respective controller of said one or more controllers may be configured to receive said heartbeat signal over said network and, upon determining that said respective controller is no longer receiving said heartbeat signal, stop transmitting a signal to said actuator. Said actuator may be configured to cut power to said one or more powered devices when said actuator is not receiving said signal from any of said one or more controllers. Said signal may be an analog signal, for example. Said signal may be transmitted over a bus, for example. For instance, a controller may transmit the signal by connecting a power source to a control signal wire of the bus. The controller may then disconnect the power source from the control signal wire to stop transmitting the signal. This ensures that that the actuator(s) will only cut power when all controllers fail to receive heartbeats if said controllers are configured to not transmit the signal upon loss of heartbeats.

Each respective controller of said one or more controllers may be configured to, upon determining that said respective controller has received said kill command, stop transmitting said signal to said actuator and prevent said actuator from receiving said signal from any one other controller of said one or more controllers. For example, a controller may connect the control signal wire of the bus to ground. This will not only cause the controller to stop transmitting the signal, but also prevent the actuator from receiving the signal when another controller is transmitting the signal. This ensures that receiving a single kill command will cause the actuator to cut power, irrespective whether if the other controllers have received similar kill commands.

Each respective controller of said one or more controllers may be configured to generate a watchdog signal, receive said watchdog signal, and, upon determining that said respective controller is no longer receiving said watchdog signal, stop transmitting said signal to said actuator. Said watchdog signal may be generated by a microprocessor of a controller or by a separate watchdog circuit of said controller, for example. This is an additional fail-safe to ensure that the actuator cuts power when all controllers fail. The controller may disconnect the power source from the control signal wire of the bus to stop transmitting the signal, for example.

Said system may comprise said one or more controllers and each respective controller of said one or more controllers may be configured to receive said heartbeat signal over said network and, upon determining that said respective controller is no longer receiving said heartbeat signal, transmit a signal to said actuator. Said actuator may be configured to cut power to said one or more powered devices when said actuator has received said signal from all of said one or more controllers. Said signal may be a digital signal, for example. Said signal may be transmitted over a local network, for example. This ensures that that the actuator(s) will only cut power when all controllers fail to receive heartbeats.

Each respective controller of said one or more controllers may be configured to transmit a further signal to said actuator upon determining that said respective controller has received said kill command. Said actuator may be configured to cut power to said one or more powered devices when said actuator receives said further signal from at least one of said one or more controllers. This ensures that one of the controllers receiving a kill command will cause the actuator to cut power, irrespective whether the other controllers have received similar kill commands. Said further signal may be a digital signal, for example.

Each respective controller of said one or more controllers may be configured to generate a watchdog signal, receive said watchdog signal, and, upon determining that said respective controller is no longer receiving said watchdog signal, transmit said signal to said actuator. Said watchdog signal may be generated by a microprocessor of a controller or by a separate watchdog circuit of said controller, for example. This is an additional fail-safe to ensure that the actuator cuts power when all controllers fail.

Said one or more controllers may comprise a first controller and a second controller and said first controller and said second controller may be powered by different power supplies. This may be used to ensure that a failure of a single power supply does not result in both controllers shutting down, thereby causing the power to the one or more powered devices to be cut. Moreover, by not making an actuator responsible for supplying power to the controller(s), a dependency chain is prevented in which one controller could cause another controller to be switched off.

Said actuator may be powered from two independent mains sources. This may be used to ensure that a failure of a single mains source does not result the in the actuator not being able to provide power to the one or more powered devices when it wants to provide power to the one or more powered devices, i.e. when it is not controlled by a controller (or multiple controllers) to cut power to the one or more powered devices.

Corresponding elements in the drawings are denoted by the same reference numeral.

1 FIG. 1 FIG. 1 5 8 3 5 3 4 5 6 A first embodiment of the system for cutting power to one or more powered devices is shown in.shows a systemwhich comprises an actuatorwhich controls the power to a powered device, e.g. a server in a rack, and a controllerconnected to the actuator. The controllerreceives power from a power supplyand the actuatorreceives power from a mains power source; these may be different power circuits.

3 21 5 8 3 3 21 5 8 3 The controlleris configured to receive a kill command over a network, e.g. the Internet, and the actuatoris configured to cut power to the powered deviceswhen the controllerreceives the kill command. The controlleris further configured to receive a heartbeat signal over the networkand the actuatoris further configured to cut power to the powered deviceswhen the controlleris no longer receiving the heartbeat signal.

1 23 23 1 FIG. In other words, systemis a killswitch/dead man's switch which triggers power-down on a lack of communications (heartbeats) from the further system. In the example of, the kill command and the heartbeat signal are received from a further system.

23 8 8 23 3 3 8 23 8 3 In a typical scenario, the further systemtries to communicate with the powered device, but is not able to get a response or to get the expected response from the power device. In this scenario, the further systemtransmits a kill command to the controller, i.e. instructs the controllerto cut power to the powered device, either automatically or in response to user input. If the further systemis no longer able to contact powered device, it may still be able to contact controller.

3 8 23 8 3 3 8 If the controllerdoes not receive the heartbeat signal, the system cuts power to the powered deviceautomatically. This might happen even before the further systemtries to communicate with the powered deviceand even works if the controllercan no longer be contacted. In this case, it may be assumed that when the controllercan no longer be contacted, the powered devicecan also no longer be contacted.

5 21 8 5 5 21 8 5 In an alternative embodiment, the system does not comprise a controller. Instead, the actuatoris configured to receive a kill command over the networkand cut power to the powered devicewhen the actuatorreceives the kill command. The actuatoris further configured to receive a heartbeat signal over the networkand cut power to the powered devicewhen the actuatoris no longer receiving the heartbeat signal.

2 FIG. 1 FIG. 2 FIG. 3 3 71 73 75 77 3 5 87 shows an embodiment of controllerofwhich features a simple analog design to control the actuator. In the embodiment of, the controllercomprises a microcontroller, a switch, a switch, and a pull-up resistor. The signal generated by the controlleris output to the actuatorvia a bus.

2 FIG. 2 FIG. 2 FIG. 87 5 5 5 8 1 FIG. High state: this causes the mains relay of the actuatorto be closed; the powered device(shown in) receives power. 5 8 Low state: this causes the mains relay of the actuatorto be open; the powered devicedoes not receive power. In the embodiment of, the busincludes at least 2 wires to the actuator: a control signal and a ground (0V). The control signal controls the mains relay in the actuator. The wire carrying the ground signal is not shown infor the sake of simplicity. In the embodiment of, the control signal has two possible states:

3 4 3 87 77 77 The controllerreceives power from power supply. The controllerwill drive the control signal wire of busvia the pull-up resistor. The value of the pull-up resistoris chosen to keep the bus voltage, under full load, above the high state threshold level.

77 73 73 71 23 71 83 73 In series with the pull-up resistoris switch. Switchis driven directly by the microcontroller GPIO (General Purpose Input/Output). If the microcontrollerno longer receives the heartbeat signal from the further system, then the microcontrollergenerates a signalto control the switchto assume the open state. This would cut power to the bus which would then drain naturally to bring the control signal to the low state, at least if no other controller is present.

2 FIG. 71 81 73 71 In the embodiment of, the microcontrollerincludes a watchdog timer which generates a signal, e.g. a reset signal, to control the switchto assume the open state when the microprocessorfails. This would cause the control signal to be driven to low state. This is designed to catch errors in the microcontroller hard-and software.

3 71 73 In an alternative embodiment, the controllercomprises a separate watchdog circuit. For example, the microcontrollermay generate a trigger signal, which is received by this watchdog circuit. If the watchdog circuit no longer receives the trigger signal, i.e. has not received the trigger signal for a period longer than a timeout threshold, the watchdog circuit generates a control signal to control the switchto assume the open state.

75 71 71 85 3 8 3 75 8 3 75 75 The switchis used to ensure that the control signal is driven low when the microcontrollerhas received a kill command. The microcontrollergenerates a signalin dependence on whether it has received a kill command. When the controllerfunctions properly and the powered deviceshould be powered, the controllerwill control the switchto be open. When power to the powered deviceshould be cut, the controllerwill control the switchto remain closed. The switchmay be a TE IM23TS relay, for example.

73 87 77 75 87 87 87 87 73 87 87 At power up, the control signal will naturally be in the low state. After the switchis closed, the control signal wire of the buswill be pulled high through the pull-up resistor. If switchis also closed, the buswill be connected to ground and the control signal wire of the buswill therefore be driven low. This pulldown has a much lower resistance than the pull up and can pull the control signal wire of the buslow safely even when the control signal wire of the buswill be pulled up high by closing switch, or when another controller is present on the busand is pulling the control signal wire of the bushigh.

2 FIG. 3 5 87 3 5 5 8 8 3 21 21 In the embodiment of, the controllertransmits analog signals to the actuator, via the bus. In an alternative embodiment, the controllertransmits digital signals to the actuator, e.g. via a local network. For example, the actuatormay be configured to cut power to the powered devicewhen it does not receive a first digital control signal from any of the controllers and configured to cut power to the powered devicewhen it receives a second digital control signal from at least one of the controllers. The controllermay be configured to transmit the first digital control signal when it no longer receives the heartbeat signal over the networkand configured to transmit the second digital control signal when it receives the kill command over the network.

3 FIG. 3 FIG. 1 FIG. 11 3 5 11 15 18 11 13 13 3 15 3 13 A second embodiment of the system for cutting power to one or more powered devices is shown in.shows a systemwhich comprises the controllerand the actuatorof. The systemfurther comprises a further actuatorwhich controls the power to a further powered device. The systemfurther comprises a further controller. The further controlleris configured in the same way as the controller. The further actuatoris connected to the controllersand.

3 13 21 5 8 3 13 3 13 21 5 8 3 13 The controllersandare each configured to receive a kill command over a network, e.g. the Internet, and the actuatoris configured to cut power to the powered deviceswhen the controllerand/or the controllerreceives the kill command. The controllersandare each further configured to receive a heartbeat signal over the networkand the actuatoris further configured to cut power to the powered devicewhen both the controllerand the controllerare no longer receiving the heartbeat signal.

3 FIG. In the embodiment of, all controllers and actuators share the same control bus. Controlling the bus from two sides gives the opportunity for hot swapping any single actuator or controller. Decoupling one actuator from the bus keeps the other actuator alive, i.e. its power is not cut, because of the feed from two sides. Similarly, removing one controller will keep the bus up as the other one can feed it.

15 5 15 18 3 13 15 18 3 13 The further actuatoris configured in the same way as actuator. The further actuatoris configured to cut power to the further powered devicewhen at least one of controllersandreceives the kill command. The further actuatoris further configured to cut power to the one or more further powered deviceswhen both the controllerand the controllerare no longer receiving the heartbeat signal.

3 FIG. 5 15 8 18 3 13 In the embodiment of, the actuatorand the further actuatorare each configured to cut power to the powered deviceand the further powered device, respectively, when the actuator loses connection to both the controllerand the controller.

5 15 3 13 3 13 3 87 3 13 5 15 8 18 3 13 75 2 FIG. 2 FIG. 2 FIG. Actuatorsandwill only cut power to the one or more powered devices if communication to both controllersandfails, i.e. if both controllersanddo not receive the heartbeat signal. When using the embodiment of controllerof, upon communication failure, the busofwill not be pulled low but will also not be fed to be high anymore. As long as one of controllersandpulls the bus high, the actuatorsandwill not cut power to the powered devicesand. If one of controllersandreceives a kill command, it will pull the bus down using switchof. This will work, even if the other controller is still pulling the bus high, because of the resistive difference between the source and the drain methods.

3 FIG. 3 13 4 14 5 6 7 15 16 17 In the embodiment of, the controllerand the further controllerare powered by different power supplies, i.e. power suppliesand, respectively. Furthermore, the actuatoris powered from two independent mains sources: mains sourcesandand the actuatoris powered from two independent mains sources: mains sourcesand. This is used in conjunction with dual power supply feeds as commonly found in datacenters to guard against the system becoming unavailable if one of the two power feeds fails or is cut off.

4 FIG. 4 FIG. 3 FIG. 41 3 13 5 15 11 43 53 45 55 43 53 4 14 45 55 43 53 A third embodiment of the system for cutting power to one or more powered devices is shown in.shows a systemwhich comprises the controllersandand the actuatorsandof. The systemfurther comprises additional controllersandand additional actuatorsand. The additional controllersandare coupled to power suppliesand, respectively. The additional actuatorsandare connected to additional controllersand.

3 13 43 53 3 43 4 13 53 14 Controllersandmay be responsible for all switches on the A-power side of a plurality of racks and controllersandmay be responsible for all switches on the B-power side of the plurality of racks, for example. Controllersandand power supplymay be located in the same cabinet, for example. Controllersandand power supplymay be located in the same cabinet, for example.

5 15 45 55 21 23 5 15 45 55 4 FIG. 3 FIG. 4 FIG. 4 FIG. The powered devices whose power supply is controlled by the actuators,,, andare not shown infor the sake of simplicity. The networkand the further systemofare not shown infor the sake of simplicity. The mains power sources to which actuators,,, andare coupled are not shown infor the sake of simplicity.

The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. As used herein, the singular forms “a,” “an,” and “the” are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will be further understood that the terms “comprises” and/or “comprising,” when used in this specification, specify the presence of stated features, integers, steps, operations, elements, and/or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and/or groups thereof.

The corresponding structures, materials, acts, and equivalents of all means or step plus function elements in the claims below are intended to include any structure, material, or act for performing the function in combination with other claimed elements as specifically claimed. The description of embodiments of the present invention has been presented for purposes of illustration, but is not intended to be exhaustive or limited to the implementations in the form disclosed. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope of the present invention. The embodiments were chosen and described in order to best explain the principles and some practical applications of the present invention, and to enable others of ordinary skill in the art to understand the present invention for various embodiments with various modifications as are suited to the particular use contemplated.